Secure Testing Device, System and Method

ABSTRACT

Headpiece (10) including a frame (22) having a support portion supported on a test-taker&#39;s head, an imaging device (14) that obtains images of an environment around and in front of the test-taker, a biometric identification system (26) that obtains biometric data about the person, a display (12) viewable by the test-taker, and a sound generator and detector (16, 18). A processor on the frame (22) is coupled to these components and controls content of the display (12) based on input received via the imaging device (14) and the biometric identification system (26). The processor also monitors detection of audio communications by the sound detector (16) relative to sound generated by the sound generator (18) and images obtained by the imaging device (14) and a test is displayed on the display (12) to determine whether a person other than the test-taker is present in an image obtained by the imaging device (14) or orally providing information to the test-taker.

TECHNICAL FIELD

The present disclosure relates generally to the field of acomputer-based system and method for taking a test while ensuring thatthe test-taker is not receiving assistance from another person orotherwise cheating while taking the test and that the device being usedfor displaying or taking the test has not been breached and is not beingbreached or otherwise compromised.

BACKGROUND ART

There has been a great deal of discussion in the press over the pastseveral years relating to MOOCs, Massive Open Online Courses. Throughthe use of the Internet, education can be freely distributed to anyonewho has Internet access. It is now generally recognized that mastery ofalmost any field taught in colleges and universities can be achieved bya motivated student without actually attending lectures at that collegeor university. Thus, the technology is in place for a student to obtainthe knowledge that has previously only been available to acampus-resident, matriculated student at a college, university or otherinstitution at virtually no cost.

In contrast, the cost of a traditional Massachusetts Institute ofTechnology (MIT) education, for example, resulting in a bachelor'sdegree can exceed one hundred thousand dollars. The only impedimentwhich exists from preventing a university such as MIT from granting adegree to an online taught student is that the university needs to knowwith absolute certainty that the student did not cheat when taking thevarious exams required to demonstrate mastery of the coursework. With adegree from MIT, for example, industry will hire such a person at astarting salary approaching or exceeding $100,000 per year. Thus, thevalue to the student is enormous. Since the information which must bemastered is now available for free on the Internet, the main impedimentseparating a motivated student from a high starting salary is that adegree-granting university must be certain that the student hasdemonstrated his mastery of the material through successful completionof examinations without the assistance of a helper or consultant whiletaking the examinations.

Even when tests are administered in a classroom, it is well known thatextensive cheating can occur. In China, for example, where admission tocollege is solely determined by the score that a student receives on aone time test, the motivation to cheat is enormous.

U.S. Pat. No. 5,565,316 (Kershaw et al.) describes a system and methodfor computer-based testing. The system comprises a test developmentsystem for producing a computerized test, a test delivery system fordelivering the computerized test to an examinee, and a workstation onwhich the computerized test is delivered to the examinee The methodcomprises producing a computerized test, delivering the computerizedtest to an examinee and recording examinee responses to questionspresented to the examinee during the delivery of the computerized test.A method of delivering a computerized test is also provided in which astandardized test is created, an electronic form of the test is thenprepared, the items of the test are presented to an examinee on aworkstation display and the examinee's responses are accepted andrecorded. A method of administering a computerized test is furtherprovided in which a computerized test is installed on a workstation andthen the delivery of the test to an examinee is initiated.

U.S. Pat. No. 5,915,973 (Hoehn-Saric et al.) describes a system forcontrolling administration of remotely proctored, secure examinations ata remote test station, and a method for administering examinations. Thesystem includes a central station, a registration station and a remotetesting station. The central station includes (a) storage device forstoring data, including test question data and verified biometric data,and (b) a data processor, operably connected to the storage device, forcomparing test-taker biometric data with stored, verified biometricdata. The remote test station includes (a) a data processor, (b) a datastorage device, operably connected to the data processor, for storinginput data, (c) a biometric measurement device for inputting test-takerbiometric data to the processor, (d) a display for displaying testquestion data, (e) an input for inputting test response data to theprocessor, (f) a recorder for recording proctoring data of a testingevent, and (g) a communication link for communicating with the centralstation, for receiving test question data from the central station, andfor communicating test-taker biometric data, test response data, andproctoring data to the central station. Verification of the test-takerand validation of the results can be performed either before or afterthe testing event.

U.S. Pat. No. 5,947,747 (Walker et al.) describes methods and apparatusfor computer-based evaluation of a test-taker's performance with respectto selected comparative norms. The system includes a home testingcomputer for transmitting the test-taker's test results to a centralcomputer which derives a performance assessment of the test-taker. Theperformance assessment can be standardized or customized, as well asrelative or absolute. Further, the transmitted test results areconfigured to reliably associate the student with his test results,using encoding, user identification, or corroborative techniques todeter fraud. Thus, for example, the system allows aparentally-controlled reward system such that children who reachspecified objectives can claim an award that parents are confident wasfairly and honestly earned without the parent being required to proctorthe testing. Fraud, and the need for proctoring, is also deterred duringmultiple students testing via an option for simultaneous testing ofgeographically dispersed test-takers.

U.S. Pat. No. 7,069,586 (Winneg et al.) describes a method of and systemfor securely executing an application on a computer system such that auser of the computer system cannot access or view unauthorized contentavailable on the computer system or accessible using the computersystem. To securely execute the application, such method and system mayterminate any unauthorized processes executing (i.e., running) on thecomputer system application prior to execution of the application, andmay configure the application such that unauthorized content cannot beaccessed, including configuring the application such that unauthorizedprocesses cannot be initiated (i.e., launched) by the application.Further, such system and method may terminate any unauthorized processesdetected during execution of the application, and may disable anyfunctions of the computer system that are capable of accessingunauthorized content, including disabling any functions capable ofinitiating processes on the computer system. The application beingsecurely executed may be any of a variety of types of applications, forexample, an application for receiving answers to questions of anexamination (i.e., an exam-taking application). Securely executing anapplication may be used for any of a variety of purposes, including,among other purposes, to assist preventing students from cheating onexams, to assist preventing students from not paying attention in class,to assist preventing employees from wasting time at work, and to assistpreventing children from viewing content that their parents deeminappropriate.

U.S. Pat. No. 7,257,557 (Hulick) describes a method, program and systemfor administering tests in a distributed data processing network inwhich predetermined test content and multimedia support material arecombined into a single encrypted test file. The multimedia support mayinclude visual and audio files for presenting test questions. Theencrypted test file is exported to at least one remote test location.The test locations import and decrypt the encrypted test file and loadthe test content and multimedia support material into a local database.The test is administered on a plurality of client workstations at thetesting location, wherein the test may include audio questions andverbal responses by participants. During the course of testing,biometric data about test participants is recorded and associated withthe test files and participant identification. After the test iscompleted, the completed test results, including verbal responses andbiometric data, are combined into a single encrypted results file thatis exported to a remote evaluation location. The evaluation locationimports and decrypts the encrypted results file and loads the testresults into a local database for grading.

U.S. Pat. Appln. Publ. No. 2007/0117083 (Winneg et al.) describessystems, methods and apparatuses for remotely monitoring examinations.Examinations are authored and rules are attributed to the exams thatdetermine how the exams are to be administered. Exam proctors monitorexam takers from remote locations by receiving data indicative of theenvironment in which the exam takers are completing the exams. A remoteexam monitoring device captures video, audio and/or authentication dataand transmits the data to a remote proctor and data analysis system.

As generally used herein, a “test” is any type of question-basedapplication that requires analysis by a person taking the test and aresponse from this person. A test may therefore be considered anexamination, a quiz, an assessment, an evaluation, a trial and/or ananalysis.

SUMMARY OF INVENTION

The present disclosure is directed at solving the problem ofguaranteeing with a high degree of certainty that a student taking atest is acting alone without the aid of a consultant or other helper orotherwise cheating.

An arrangement for test taking for use with a computer includes a headwearable device which includes at least one sound sensor for detectingsound, at least one optical imaging device that obtains images of anarea viewed by the student, and a display which is only viewable by thetest-taker. The display can be a light emitting display such as an OLED,a light reflective display or a retinal projector display. A processingunit is coupled to the sensor(s) and imaging device(s) and receives andanalyzes data therefrom to determine whether the test-taker isinteracting with another person and/or whether the test-taker isreceiving communications from another person. The processing unit alsodecrypts the tests questions sent to it for display on the display.

A headpiece in accordance with the invention includes a frame having asupport portion adapted to be supported on a person's head and aviewable portion adapted to present visual data to the person when thesupport portion is supported on the person's head. This headpiece may beof the type similar to, for example, Google Glass™. A self-containedelectronics assembly includes at least one imaging device and a displayand is arranged on a frame similar to a glasses frame and obtains imagesof an environment around the person when worn on the person's head. Aprocessor is arranged within the self-contained electronics assemblymounted on the frame and is coupled to a computing device such as apersonal computer, laptop or tablet. The processor is configured tocontrol content of the viewable portion based on input received from theconnected computing device. At least one microphone is integral with theelectronics assembly which detects audio communications. The processormonitors detection of audio communications detected by the at least onemicrophone and images obtained by the at least one imaging device whenthe viewable portion is displaying a test to determine whether a personother than the person on which the frame is supported is present orproviding information to the test-taker. The microphone may be used as auser interface in which case the processor monitors detection of soundby the microphone when the viewable portion is displaying a test.

A method for detecting an attempt to physically alter the electronicsassembly in accordance with the invention is a type of chassis intrusiondetector. In the method, the device is enclosed within two closelyspaced conductive films overlying one another to define an envelope. Thecapacitance between the films is periodically measured by means of asecurity assembly coupled to the films, and the measured capacitance ismonitored by means of the security assembly to determine changes incapacitance, changes in capacitance being correlated with an attempt toalter the device, i.e., detection of possible intrusion into the chassisof the device. Alternatively, the closely spaced conductive films can bereplaced by a film onto which is deposited a labyrinth of conductivewires comprising a continuous circuit. The resistance capacitance and orinductance of the circuit is monitored for a break in the circuit whichwould correlate with any attempt to breach the electronics and sensorassembly.

The security assembly includes a processor, a power source for providingpower to the processor and a volatile RAM assembly containing a requiredsecurity code, or private key, for use of the device for test-takingpurposes. The security assembly is configured such that any attempt todisassemble the security assembly will break one or more wiresconnecting the power source to the RAM or cause a change in capacitanceresistance or inductance relative to a threshold which will cause thesecurity code to be erased from the RAM assembly. The security assemblyis coupled to the electronics assembly which with the security assemblyresides within the space enclosed by the films or wire labyrinth. Anaperture is provided in the envelope defined by the films or wirelabyrinth in which the electronics assembly is placed, the aperturepermitting a wire to connect the electronics assembly to the externalcomputing device. The films or wire labyrinth are sufficientlytransparent as to permit the camera(s) to obtain images there throughand permit viewing of the display by the test-taker.

An intrusion-protected electronic device in accordance with theinvention includes an envelope defined by two closely spaced conductivefilms overlying one another, or wire labyrinth, that enclose theelectronics assembly including the security assembly coupled to thefilms and that periodically measures capacitance between the films orthe resistance or inductance of the wire labyrinth. The securityassembly is configured to monitor the measured capacitance, resistanceand/or inductance to determine changes in one of these properties,changes in any of these properties being correlated to an attempt toalter the device.

Additional devices which can be part of the electronics assembly andwhich are designed to operate through the security films include:

-   -   1. A camera for obtaining iris, retinal or partial facial scans.    -   2. A microphone for monitoring sound in the vicinity of the        test-taker.    -   3. A sound maker used for testing the microphone sensitivity.    -   4. A camera for monitoring the area between the display and the        test-taker's eye.

BRIEF DESCRIPTION OF DRAWINGS

The following drawings are illustrative of embodiments of the systemdeveloped or adapted using the teachings of at least one of theembodiments disclosed herein and are not meant to limit the scope of thedisclosure as encompassed by the claims.

FIG. 1A is a perspective view of a head worn glasses type devicecontaining an electronics assembly with several sensors, cameras and adisplay all protected with a chassis intrusion detector prepared usingthe teachings of this disclosure.

FIG. 1B is a perspective view of the apparatus of FIG. 1A seen from therear.

FIG. 2 is a flowchart illustrating a startup, running, and shut down ofthe test taking process in accordance with the invention using theapparatus shown in FIGS. 1A and 1B.

FIG. 3 illustrates a flowchart for the encryption scheme utilized by theapparatus shown in FIGS. 1A and 1B to prevent access to the test byother computers or devices than the designated head worn apparatus.

FIG. 4 is a pattern recognition flowchart using neural networks foridentifying the test taker using the apparatus shown in FIGS. 1A and 1B.

FIG. 5A is a perspective view of a similar apparatus using a modifiedGoogle Glass™ as a test taking device, FIG. 5B is a plane view of FIG.5A looking from the front and FIGS. 5C and 5D are similar views to FIGS.5A and 5B but showing the addition of prescription lens.

FIG. 6 is a view of a test-taker using the head worn apparatus of FIGS.1A and 1B with the addition of prescription lenses interacting with acomputing device.

FIG. 7 is a schematic of the operation of the chassis intrusion detectorin accordance with the invention.

FIG. 8 illustrates the use of the apparatus in accordance with theinvention by a room full of test-takers where each device is attached toa central computer through a USB port.

FIG. 9 is a view similar to FIG. 8 with a wireless connection through awireless transmitter box associated with each desk and where thetest-takers are using paper to record their test answers.

FIG. 10 is a flowchart illustrating a startup, running, and shut down ofthe test taking process in accordance with the invention.

BEST MODE FOR CARRYING OUT INVENTION

A primary concept of the present disclosure is that a student locatedanywhere in the world ought to be able to obtain the equivalent of adegree from any college or university, providing that the student canprove that he or she has mastered the coursework. This proof naturallymust come from the student passing a series of examinations. Since thestudent can be located anywhere in the world, it can be impractical forthat student to travel to a particular place in order to take anexamination.

A secondary concept of the present disclosure is to permit a classroomfull of students to take a test without cheating.

Hiring organizations basically do not care where the person has acquiredthe expertise as long as they can be confident that the student has doneso. As an employer, for example, a manager does not care as much whethera person graduated from Harvard or MIT but he does care in particularwhether the prospective employee has mastered the coursework. On theother hand, having a degree listed on a person's resume can greatlyaffect the person's opportunities for employment throughout his or herlifetime. In the United States, however, colleges and universities havebecome unreasonably expensive especially when consideration is given tothe fact that for the most prestigious schools, the student usually isrequired to reside on or near the campus. This residency requirement haslittle to do with his or her mastery of physics, engineering or otherscientific or non-scientific subjects, but handicaps an otherwisequalified student from job opportunities.

A student can typically learn the coursework on his or her own and infact, studies have shown that for many students attending class islargely a waste of time. Over the Internet, a student can be exposed tothe very best teachers providing well constituted lectures, textbooksand other coursework. If this is done with a large number of students,the cost per student is minimal. What is needed, however, is a method ofverifying that a particular student has mastered the subject matterthrough taking and passing a particular examination over the Internet orin a classroom and without cheating and at minimal cost to theinstitution.

An objective of the present disclosure is therefore to provide a systemthat is capable of ascertaining the identity of a test-taker withcertainty and that cheating has not occurred during test taking. Priorto discussing how these goals are achieved an understanding of thecheating prevention process needs to begin with an analysis of the flowof information from the test providing institution to the student'seyes.

For now, assume that the test is a multiple choice test or one where theanswer is in the form of a number. The institution can randomize thequestions on a particular test so that no student will take the sametest with the same order of the questions. Therefore, knowing theanswers provided by one student cannot help another student. As aresult, the answers which are sent back to the institution do not needto be encrypted.

The questions making up the test however do need to be encrypted andcareful attention needs to be paid to where the decryption processoccurs and to the protection of the private key which performs thedecryption. For example, if the decryption occurs in an unprotectedcomputer, then two problems arise. First, the decrypted test can becaptured and a copy sent to a computer in another room, for example, orthe private key can be copied and a second computer anywhere in theworld can simultaneously decrypt the test. Once the test can be viewedby a consultant who is not in the test-taker's room, then the consultantcan transmit the answers to the test-taker facilitating cheating.

Consider how the consultant might conduct this transmission to thetest-taker. Perhaps, the consultant is in an adjoining room andtransmits the answers using RF communication to a device hidden on thebody of the test-taker which retransmits to a receiver pressed against abone in the test-taker's head, hidden by his or her hair, or mounted onhis or her teeth. Both such devices are readily available. The RFfrequencies used can be chosen to be undetectable by any device designedto detect such transmissions since the range of frequencies availablespan more than 6 orders of magnitude and, in addition, frequency hoppingtechniques can be used. Also, an RF sensor mounted anywhere on thestudent cannot pickup such transmissions without knowing the transmittedfrequency and coding scheme.

Even if the consultant is in another country as long as he or she cansee the test, there is no way to prevent the transmission of the answersto the test-taker. Other methods include vibrators in the seat, wireswhich attach to the bone-mounted speakers, etc. The consultant can evenproject the answers onto a portion of the room which is not covered byroom monitoring cameras but observable by the test-taker and can evenalternate such locations to fool systems that monitor the test-taker'sbehavior. Basically, there is no method of preventing the consultantfrom communicating the answers to the test-taker and therefore it isnecessary to prevent the consultant from obtaining a copy of the testquestions.

If the questions are decrypted on an ordinary computer, then manypotential information leakage problems exist. Regardless of theoperating system, if the consultant can obtain access to the processorboard of the computer, then the connector that connects to the displaycan be removed and reconnected into a splitter inserted in such a mannerthat the display operation is unaffected but a second set of wires arenow available which contain the display information. These wires can beconnected to a small processor which connects them to a transmitter tosend the display information to another room by undetectable RF.Alternately, a simple wire can be used, hidden from view of whatevercameras are present.

Another approach is to steal the private key which cannot be protectedin an arbitrary computer. Once the consultant has the key, then he orshe can intercept the transmissions to the computer and decode the testin a second computer. The conclusion is that the private key must bestored and the decryption process must be undertaken in a specialprotected device which will be discussed below.

Consider now the display. If there is a display where the questions canbe seen from anywhere other than the eyes of the test-taker, then thereis another path for leakage of the test questions. Assuming that thedecryption occurs right at the display and the display is protected fromtampering, the display itself can facilitate transmission of the testquestions. A camera looking through an undetectable port in a wall orundetectably worn by the test-taker can capture the image of the testquestions and transmit this to a consultant by any number of methods.Thus, either the display must be scrambled so that only the test-takerwearing special glasses can see the questions or the display must be soclose to the test-taker's eyes that no one else can get close enough tosee it. The second of these approaches will be discussed below. Theconclusion is that no ordinary display or ordinary computer is usablewithout incurring a risk of cheating.

Some methods for accomplishing the objective of cheating preventionwhich have been considered include using one or more cameras which canimage a substantial portion of the space around the test-taker so that aconsultant (or other person aiding the test taker) cannot be located ina position where he or she can influence the test taker without beingseen by one or more cameras. A structure has been proposed such that thecomputer on which the test is being taken will not be accessible byanother computer in another room, for example, where a consultant cansimultaneously view the exam and communicate the answers to the testtaker. If this structure is separated from the display and if thedisplay is not scrambled or very close to the test-taker's eyes, asdescribed above, this approach can be easily defeated. Also, it is notrequired that the consultant be where he or she can be observed by anycameras.

Similarly, it has been proposed that a microphone is preferablyavailable to monitor the audio environment where the test taking isoccurring to prevent audio communication with the test-taker by aconsultant. A microphone will not pick up communications from theconsultant in the form of RF communications translated into sound at ahead bone. The microphone will pick up any oral communications from thetest-taker and thus is a necessary part of the system to detect if thetest-taker is orally reading the questions to a consultant. In order tomake sure that the microphone has been activated, a speaker or othersound source may be necessary to periodically create a sound which canbe sensed by the microphone. Otherwise, the test-taker can cover themicrophone or otherwise render it useless. These and other methods andapparatus are discussed below but already it has become evident to theinventor that the apparatus that is used to take the test must beespecially designed to solve the issues mentioned above.

The identity of the test-taker must be known and can be ascertainedusing one or more of a variety of biometric sensors and systems such asa palm, fingerprint, iris, retinal or other scan, a voiceprint, or agood image of the test-taker coupled with facial recognition as furtherdiscussed below. For the purposes of the present invention, the primarybiometric identification system will rely on the use of a small camerawhich has been designed to periodically scan the test-taker's iris,retina or portion of the test-taker's face as discussed below.

When taking a test, the student can go through a process which sets upthe apparatus and validates its operation. The student can then confirmhis identity which will have been previously established and storedlocally or remotely for comparison. The process of ascertaining theidentity can be recorded for later validation. Output from the variousmonitoring systems can be fed to one or more pattern recognition systemssuch as trained neural networks which have demonstrated a high accuracy.

Each time the student takes a test and demonstrates his or herproficiency in knowing the course work, he or she can be awarded creditsand after sufficient credits have been obtained, he or she can beawarded a degree. After the degree award, the student would thenpresumably begin working for a company, government agency, or otherorganization and the system should periodically be verified throughconsultations or surveys with the management of the organization toascertain that the hiring organization is satisfied with the proficiencyof the student as learned from the online courses. This feedback allowsfor continuous improvement of the overall process and system.

Naturally, the degree granting institution will incur some costs duringthis process and thus, some payment from the student to the institutionmay be considered. Depending on the circumstances, this payment can be acharge per course, per test or per degree. Since the earning power ofthe student can be significantly increased, and the out-of-pocket costto the institution is small, these payments can be postponed until thestudent is being paid by a hiring organization and, in fact, such anorganization may be willing to cover these payments. In any event, thepayment should be very small when compared to the typical cost of atraditional college education. However, the degree-granting institutionby this method, can greatly expand the number of degrees granted andthus although the payment per student will be small, the total sumearned by the institution can be large.

A good review of the state of higher education in the United States andin particular of the rise of MOOCs can be found in the Nicholas Carr'sarticle on the subject as published in the MIT technology review. Thearticle can be found on the following Internet website.http://www.technologyreview.com/featuredstory/429376/the-crisis-in-higher-education/.Quoting from this article “Machine learning may, for instance, pave theway for an automated system to detect cheating in online classes, achallenge that is becoming more pressing as universities considergranting certificates or even credits to students who complete MOOCs.”It is the objective of this disclosure to respond to the mentionedchallenge.

As discussed in numerous places in the literature, there is asignificant difference in the complexity of evaluating a student'sproficiency through tests which can be machine graded depending on thecourse subject matter. For those math and science courses where anumerical answer is to be derived, machine evaluation of the test isrelatively simple. However, for those disciplines where a reasoning orwriting skill or in particular an artistic skill is evaluated, there isgreat controversy as to whether this can be done by machine testing.This issue will not be addressed further here other than to note thatmore research in this area is necessary.

It is not an objective of this disclosure to determine how a test shouldmeasure a student's proficiency nor how it should be graded. The primaryobjective here is to provide confidence to the degree-grantinginstitution that the student who is taking a test is in fact the studentwho has registered for the course and that the student is acting alonewithout the aid of a consultant who may be remote or nearby. Thisassurance should be provided with a probability of cheating reduced toon the order of one in 100,000 and, similarly, the false accusation thatcheating is taking place reduced to a similar probability.

When a student decides to enroll in a degree program, for example, oreven to enroll in a particular course for which he or she desirescredit, the first step will generally be to register with theorganization, typically a college or university, and to establish thebeginning of the student's record. During this registration process, forthe case where the student intends to get credit for one or more coursestaken online, the student will be required to submit various types ofinformation which will permit the student to be identified positivelyover the Internet. Although generally there may be no charge for takingthe course, there will generally be some charges related to the testtaking and administration of the student's program. In a preferredembodiment of this invention, a specially configured device will be soldto the student to be used primarily for test taking.

Wearable glasses which meets the objects of this invention is describedbelow and is configured so that all of the functions necessary toidentify the student and significantly reduce the opportunity forcheating are incorporated within the glasses design, hereinafter calledthe Test Glasses. At the end of the course or when the student completeshis relationship with the institution, he or she may be required toreturn the glasses; however’ since the glasses will be linked to thestudent's biometric=based identification, the biometrics stored on thedevice would need to be erased or overwritten by those of anotherstudent as described below.

Since the value of a degree from a prestigious institution can beimmense, the motivation to cheat when taking a test can be enormous. Onecan foresee, for example, an industry of consultants developing solelyfor the purpose of aiding students in taking tests and thus obtaining adegree. The system of this disclosure is therefore configured tominimize the possibility of success of such consultants.

If a student, when taking a test, is inclined to cheat, this inclinationcan be facilitated if a helper or consultant has access to the displaywhich shows the test while it is being taken. If the consultant has suchaccess, then he or she will use a communication method by which he orshe can transfer information to the test-taking student in a manner thatcannot be detected. This disclosure is intended to minimize theopportunity of the consultant from observing the display or otherwiselearning the content of the test questions and/or of being able tocommunicate with the test-taker.

If the student were to use his or her private computer for displaying atest, it would be generally relatively easy for a consultant to attach asecond remote monitor which would display the same information as theprimary monitor. There exists software, for example, which permitssomeone who is even located remotely from a particular computer toobserve the display of that computer. Alternatively, if the student orhis consultant has access to the ports and operating system of thecomputer upon which the student takes tests, access to the informationon the display is relatively simple to achieve. The only method ofpreventing this is to design a device which prevents other computersfrom connecting with the device in such a manner that the display can becopied. Thus, in a preferred implementation of the invention, it will beassumed that a special device, and in particular a wearable glasses typedevice, has been configured and provided to the student for those caseswhere the student desires credit for the course he or she is taking.

A device constructed in accordance with the teachings of this inventionis illustrated in FIG. 1A which is a perspective view of a head wornglasses type device, the Test Glasses, containing an electronicsassembly with several sensors, cameras and a display all protected witha chassis intrusion detector prepared using the teachings herein. A headworn display and electronics device constructed in accordance with theinvention is shown generally at 10 in FIGS. 1A and 1B.

A housing 20 extends from a frame 22. Housing 20 is substantiallyL-shaped with a first portion extending straight outward from an edge ofthe frame 22 and second portion perpendicular to the first portion andpositioned in front of the frame 22.

A display 12 is arranged on or in the housing 20 and pointed toward theright eye of test-taker displays the test questions (althoughalternatively, a display can be pointed toward the left eye of thetest-taker). A forward viewing camera 14, representative of an imagingdevice, is also arranged on or in the housing 20 and monitors the fieldof view of the student outward from the device 10. The camera 14 canhave a field of view of approximately 120°. A microphone 16 is alsoarranged on or in housing 20 and monitors talking (sounds) which cantake place while the test is in progress. A sound maker or speaker 18 isarranged on or in the housing 20 and periodically provides a sounddetectable by the microphone 16 so as to verify that the microphone 16has not somehow been rendered inoperable.

The display 12 is arranged at a terminal end of the second housingportion. The forward viewing camera 14, or more generally an imagingdevice, the microphone 16 and the speaker 18 are also arranged on thesecond housing portion (see FIG. 1A).

Each of these components 12, 14, 16, 18 is connected to aprocessor-containing electronics package in housing 20 which is mountedto the glasses frame 22 in a manner known to those skilled in the art towhich this invention pertains. A cable emanates from the electronicspackage in housing 20 and can contain a USB connector 24 for connectingonto an external device such as a computer.

An iris or retinal scan camera 26 is arranged on housing 20, pointinginward toward the wearer, and measures biometrics of the test-taker (seeFIG. 1B). Such biometrics can include an iris or retinal scan or a scanof the portion of the face surrounding the eye. Illumination of the eyecan be provided by LEDs 28 arranged on the housing 20 which can be inthe IR or visible portions of the electromagnetic spectrum. Two or moredifferent levels of visible illumination can be provided to cause theiris to be seen at different openings to check for an artificial irispainted onto a contact lens. The iris scan camera 26 and LEDs 28 arearranged on the second housing portion (see FIG. 1A).

A camera 30 can also be provided on or in housing 20 to check for anyanomalous activity which might take place in the vicinity of the glasses10 (see FIG. 1B). Such a camera 30 can enable detection of whether animage capture device has been either temporarily or permanently affixedto the device 10 or to the face of the test-taker which is capable ofcapturing the image on the display 12. Similarly, camera 30 can monitorthe space surrounding the left eye of the test-taker to assure that suchan image capturing device and or another display for providing aid tothe test-taker is not being employed by the student in conjunction withhis left eye. The camera 30, or more generally an imaging device, isarranged on the first housing portion and oriented to image most of theframe 12 (see FIG. 1B).

Software and a processor which controls administration of tests isresident on the external computer, in the electronics package in housing20, or in another device, not shown, which attaches to the device 10through connector 24. A student will have access to a keyboard and/or amouse for interacting with this computer, not shown. Using a keyboard,the student can initiate the test taking process through communicationwith the test provider. When the test is ready for execution by thestudent, and encrypted version of the test is transmitted to thecomputer and relayed to the device 10. The electronics package inhousing 20, e.g., including a processor, utilizes a private decryptionkey to decrypt the test questions and cause them to be displayed ondisplay 12. The test-taker then enters the answers to the questionsusing the keyboard and the computer display.

The test is preferably configured such that the answers do not provideinformation relative to the question. Therefore, someone viewing theanswers cannot discern therefrom the questions. Therefore, the questionanswers do not need to be encrypted but can be sent in an on unencryptedform to the test providing institution.

For example, if the test providing institution is providing tests to1000 students either simultaneously or at different times, and if thetest is of a multiple-choice type and contains 50 questions, the orderof the questions will be different for each test provided. Since thisprovides a very large number of different tests each containing the samequestions, there is little risk that answers from one set of questionscan be of any value to a student taking a different ordered set of thesame questions.

The entire electronics package of the device 10 is encapsulated in athin film 32 called a chassis intrusion detection film. This film cancomprise two conductive layers separated by thin layers of plastic. Theelectronics package in housing 20 can contain a processor or structureproviding processing capability for measuring the capacitance betweenthe two conductive layers. If this capacitance is changed, as mighthappen if someone attempts to break into the electronics package, thenthe event can be detected through a change in this property.Alternatively, an array of wires can be printed onto a plastic filmeither before or after it has encapsulated the electronics package inhousing 20 in such a manner that any attempt to break into the housing20 will sever or otherwise disrupt one or more of the wires. The wirescan be made from indium tin oxide and thus be transparent. The wires canbe thin, such as about 0.005 inches wide, and have a similar spacing.

The private key for decoding the test questions and any other commandssent by the test providing institution can be held in volatile RAMmemory in, for example, housing 20 which is kept alive through anextended life (10 years) battery which also can be recharged when thedevice 10 is connected to the host computer through connector 24. If thechassis intrusion detector system detects an attempt to break in to thehousing 20, then the power to the RAM memory will be shut off and theprivate key permanently lost.

When the test-taker is preparing to take a test, he or she will placethe device 10 onto his or her head. When this happens for the firsttime, attributes of the retinal, iris or other biometric scan will berecorded in memory for later comparison. When this is accomplished, asignal can be sent to the computer or processor indicating that thetest-taker is ready to take the examination. When the test-taker engagesin taking a second test at a later time, a new biometric scan will beconducted to ascertain that this is the same person who originallyregistered using this device 10. If this scan comparison, e.g.,performed using the processor in electronics package in housing 20, issuccessful, then the display will be activated and a signal can be sentby the processor to the test provider via the external computer toforward the encrypted test.

The biometric scan camera 26 is controlled to periodically check toascertain that the test-taker's iris is present and that it has notchanged, possibly in conjunction with the processor in the electronicspackage in the housing 20. If anything anomalous occurs, such as theabsence of an iris or the change of an iris, then the display 12 will bedeactivated by the processor. Thus, when the student removes the device10, the display 12 will automatically stop displaying the testquestions. Similarly, if the student transfers the device 10 to anotherperson whose iris does not match that of the student, then the display12 will not show the test questions. Above and in what follows, the iriswill be used to represent any of the aforementioned biometric scans.

When the student has completed the test questions, then he or she willindicate such through the computer keyboard and the display 12 will nolonger display test questions. The remainder of the interaction with thetest providing facility will then occur through the keyboard and/ormouse and the external computer.

The forward-looking camera 14 can have a field of view of 120°. Thisfield of view will cover the hands of the test taker to check for thecase where the test-taker is typing in the questions on a keyboard wherethey are transmitted to a consultant. If the hands of the test-takercannot be seen by camera 14, the display will be turned off until thehands can be seen. If this happens frequently, then the test can beterminated. Camera 14 can also be used to check for the existence ofother devices in the vicinity of the test-taker. These devices mayinclude a tablet computer, a smart phone, books or papers, displaysother than the test answers on the external computer display, or anyother information source which is not permitted for the particular test.Naturally, if the test is an open book tests, then searching of theabove listed objects can be permitted. The software which accomplishesthese pattern recognition tasks can utilize one or more trained neuralnetworks.

A limited number of encrypted commands which relate to the particulartest being administered can be transmitted with the encrypted test fromthe test providing institution. These commands control some aspects ofthe test taking process such as whether it is an open book or closedbook examination, whether it is a timed test, how many restarts arepermitted, how many pauses are permitted etc., since the test process iscontrolled by the Test Glasses, these commands will be decrypted andused to guide the test taking process by the Test Glasses.

Camera 30 similarly can be used to check for anomalies in the vicinityof device 10. Again, the pattern recognition software used with camera30 can utilize one or more trained neural networks. This camera 30 cancheck for small cameras which may have been glued to the face of thetest-taker which are not observable by the iris scan camera 26 butnevertheless can capture a view of the image displayed on display 12.This of course is less of a problem if a direct retinal projectordisplay is utilized. This camera 30 also can be used to monitor foranomalous devices which can be seen by the student's left eye whichcould be a source of information to the test taking student. To furtherguard against such anomalous events, a second camera, not shown, may beplaced on frame 22 but at another location giving a better view of thespace surrounding the student's left eye.

Generally, there should be no talking while test taking is in progress.Microphone 16 is used to detect audio sounds and in particular spokenwords. If such words are detected particularly emanating from students,then the test can be paused or terminated depending on thetest-providing institution's requirements. Information as to what theresponse required of device 10 for this or any other anomaly can be sentin encrypted form from the test providing institution. In order toprevent spoofing of these commands, when the device 10 detects ananomaly, it can transmit a request for action to the test-providinginstitution via the host computer. The test-providing institution canrespond with encrypted instructions as to what action to take.

The encrypted instruction can include a rolling code such that messagesrequiring the same result from the apparatus 10 will not identical andthus not able of being spoofed. In order to prevent microphone frombeing covered with sound absorbing material, a speaker or sound creator18 is provided to periodically create a sound which is then detected bythe microphone and the quality of the detected signal can beascertained. If the microphone cannot clearly hear the sound produced bythe speaker, then the tests can be terminated until the issue isresolved. Speaker 18 may be placed at an alternate location on thehousing 20 or frame 12 of in order to minimize direct sonic conductionthrough the structure.

FIG. 1B is a perspective view of the apparatus of FIG. 1A looking fromthe rear.

A flowchart illustrating a startup, running, and shut down of the testtaking process is illustrated in FIG. 2 generally at 100 and in moredetail in FIG. 10. At step 102, the student activates the host computerto begin the test taking process. At step 104, the student enters his IDwhich is transmitted to the test-providing institution, most likely viathe Internet. The device 10 then uses the iris camera 26 to scan theiris of the test taker at step 106. As mentioned above, other biometricscan be substituted for the iris scan; however, for the purposes of thisdisclosure, all of these various biometric measurements will beequivalent to an iris scan.

In the event of a successful passing of the iris scan in comparison withthe stored attributes of a previous iris scan, the device 10 willindicate to the host computer that the biometrics verification has beensuccessful. The student will then be requested to identify the course IDfor which an examination is requested at 108. The test will then bedownloaded at 110 in encrypted form to the host computer and relayed tothe device 10 where it will be decrypted and display onto display 12.The test will then commence at step 112, the timer started ifappropriate at 114 and student will enter his or her answers using theexternal computer until completed. When the student has completed thetests, he will so indicate using the external computer and the processfinishes at step 116.

For the case where a fixed time limit is provided for taking the test,an encrypted message indicating this fact will be sent from thetest-providing institution to the host computer and from there to thedevice 10 and a timer will initiated within the electronics package inhousing 20 which will then turn off display 12 at the end of theallotted time.

As discussed above, when a student attends a teaching institution, he orshe may indicate his or her desire to take examinations at a privatelocation apart from the institution, in which case, the institution willprovide the student with device 10. The institution then can take apre-manufactured device 10 and create a public-private key paired set ofencryption keys and then download the private key onto the device 10.Once the private key is resident on the device 10, a command can be sentto disable future communication with the RAM memory in housing 20. Thiscan be done through burning of fused links within the device 10. At thispoint, the private key can no longer be changed and the institution willthen erase its copy of the private key wherein the only existing copyresides on the Test Glasses where it cannot be retrieved.

When a student matriculates, the institution can enter the student's IDinto the device 10 and then ship the apparatus to the student. When thestudent first utilizes the device 10, the device 10 will capture thepattern of the student's iris and store it in memory in the electronicspackage in housing 20. Once this has been accomplished, the device 10can only be used by that particular student and the test providinginstitution can only communicate with the device 10 through encryptedmessages using the public key portion of the encryption keys pair.Later, when the student terminates his or her association with theinstitution and returns the device 10 to the institution, theinstitution can send encrypted messages to the device 10 which erasesthe students ID and iris scan attributes from the device memory and thedevice 10 is now suitable for reuse by another student.

This process depicted in FIG. 3 generally at 200 where the device ismanufactured at step 202 and encoded with the private key at 204, thestudent's ID is entered at 206 and the device shipped to the student at208. The student uses the device for taking tests at 210 and whenfinished, returns the device to the institution at 212. The institutionthen erases the student's ID and biometrics at 214 and the device 10 isready for a new student ID at 206. Note that under this implementation,the student's biometrics never leave the protection of device 10 andcannot be used for any purpose other than identifying the student fromtest to test.

FIG. 4 provides a flowchart for the iris scan verification process showngenerally at 300. At step 302, the iris imaging camera 26 takes an imageof the student's iris and transmits the image to step 304 where acomparison of the immediately obtained image to the stored image isconducted. In a preferred implementation, two images on the iris areretrieved under two level of visual illumination and both images aremade available for analysis. The illumination levels are controlled bythe LEDs 28 which are provided to guard against the student wearingcontact lenses containing a printed iris. Other biometric measurementscan be made in a similar manner such as a retinal image or an image ofblood vessels in the student's face. For the purposes herein, the wordiris will be used to represent all such biometric measurements.

If the iris comparison test is passed as indicated in step 306, the testdecryption and display process proceeds at step 308. If the test fails,then the student is notified to adjust the device 10 and the counter isincremented at step 310. The count is checked at step 312 and if it isbelow the maximum established by the test-providing institution, thenthe test is repeated. If the count is at a maximum, then the test takingprocess is terminated at step 314.

The iris camera 26 will continue to monitor the student's eye and if atany time the iris is not detected, then the display 12 is turned offuntil the iris reappears. This might happen if the student removes thedevice 10 from his or her head to take a break, for example. After sucha break and at other random times, the iris check can be repeated toascertain that the same student is using the device 10. Thus, thecontinued test taking process is monitored to guard against the changeof the test-taker or any attempt to make the display 12 visible byanyone other than the authorized student.

When the iris checking process is complete, the test can be transmittedto device 10, decrypted and displayed.

To use the device 10 in this manner, the electronics, sensors anddisplay should be protected with a chassis intrusion detector with theprivate key stored in RAM volatile memory with its own long life batterypower supply as described herein. If this is not the case, then thedevice 10 can be opened and the display images transmitted off thedevice 10, and if the private key is stored in nonvolatile memory, itcan be retrieved and used by another computer which is designed to spoofthe device 10. With the cost of education approaching or exceeding$100,000, there is ample motivation to undertake these actions. Thechassis intrusion detector is described below.

FIG. 5A is a perspective view of a similar apparatus using a modifiedGoogle Glass™ as a test taking device, FIG. 5B is a plane view of FIG.5A looking from the front and FIGS. 5C and 5D are similar views to FIGS.5A and 5B but showing the addition of glass lenses. An advantage of thisdesign is that secure test taking can be an add-on feature of GoogleGlass™ thus providing many more uses for the device other than fordedicated test taking. The device is shown generally at 400 and includesadded headphones 402, a forward looking camera 406, a microphone 404 anda display 408, all in a housing attached to or integral with the frameof the glasses. Since Google Glass™ does not come equipped with achassis intrusion detector and since the test decryption would occur inthe general processor, the device is prone to being hacked which woulddefeat the purpose of a secure testing device. Also, the display 408 canprobably be observed from the front thus providing an easy access to thetest display by a consultant. Nevertheless, Google Glass™ can bemodified by adding a chassis intrusion detector and other features asdescribed herein to render it a dual purpose device allowing a studentto get the advantages of Google Glass™ as well as a secure test takingdevice. Of course, the headphones 402 could be replaced with a bonespeaker as in Google Glass™.

FIG. 6 illustrates a view of a test-taker using the head worn apparatus422, as in FIG. 1 with the addition of prescription lenses, interactingwith a computing device represented by a tablet 420. Although thetouchscreen on the tablet 420 could be used, in this example a keyboard426 and mouse 428 are provided to simplify the test taking process. Theapparatus 422 provides a forward looking camera 424 which is differentfrom cameras used in Google Glass™, for example, in that it provides afield of view that closely matches that of the student.

In particular, the hands 430 of the student can be monitored by thiscamera 424 to ascertain that the student is not communicating with theconsultant through typed messages using the keyboard 426. Since thecomputer used by the student to provide answers to the questions has notin any way been secured, it could be used as a method for the student tocommunicate with a consultant. Similarly, other devices such as a smartphone or additional tablet computer, may be hidden by the student andused to send the questions to the consultant and receive communicationsback relating to the appropriate answers. Thus, the camera 424 and theassociated pattern recognition software is an important aspect of thisinvention.

The pattern recognition software can be located within the electronicspackage associated with the device 422, e.g., in a housing extendingfrom or integral with the frame, and can be based on a trained neuralnetwork. One key advantage of this approach is that as experience isgained with the system, the neural network can be readily trained tocheck for various newly discovered cheating methods. The fact thatneural networks can be used in this fashion permits continuousimprovement of the apparatus 422.

There are other sensors including the iris imaging camera, theeye-to-display monitoring camera, and the microphone, that similarlyprovide data which contain patterns which are appropriate for neuralnetwork analysis. In some cases, initially this analysis can besimplified by using the differences between two images. For example, forthe eye-to-display monitoring camera, it is expected that the image ofthis should be invariant and therefore any significant changes in thatimage would be indicative of an anomaly which should be brought to theattention of the student for remedial action. Similarly, once the testhas begun, there should be no voices sensed by the microphone andtherefore if any voice frequencies are present the anomaly can behighlighted for remedial action by the student. The iris image analysiscan be somewhat more complicated, however, again since it is thedifference between two such images which is significant, the analysiscan at least initially be relatively uncomplicated. The differencebetween two images of the same student should be relatively minorwhereas the difference between another person's iris image and that ofthe student can be quite complicated. This should be easily detectable.In order to guard against the use of a contact lens with a paintedsurface showing an invariant iris image to a iris imaging camera, LEDs28 are provided to cause the iris to change its opening aperture due tomore intense illumination thereby giving two different images of theiris for verification. Again however, the analysis can be relativelysimple where in the first instance the iris which is imaged under thetwo different conditions is recorded and thereafter only imagesubtraction and relatively minor analysis is required.

An objective of this test taking system is that it is completelyautomatic without requiring the intervention of any human other than thetest-taker 410. The institution administering the test will have alimited set of rules which, if violated, will render the test invalid.These rules can be general rules or rules specific to the particulartest being taken. These rules can include: the events which willinvalidate a test; the number of times that the test, once an event hasoccurred, can be restarted if any; the number of times that a particulartest can be taken if failed; the time permitted to take the test; thenumber and length of pauses permitted during the test taking process;etc. The rules may or may not be notified to the test-taker 410.

All of this puts a small burden on the institution to draw arbitrarylines as to what constitutes cheating and what does not. This is arelatively light burden with the test taking apparatus, the TestGlasses, since once the rules have been set the opportunities for anundetected violation of these rules are very limited or nonexistent.

A substantial number of sensors have been introduced, each of thesesensors requires an algorithm to assess the sensor output and determinewhether the test-taker is cheating or not. Since the Test Glasses areprovided with a chassis intrusion detector (CID), as discussed below, itis virtually impossible for a consultant to modify the apparatus 422 soas to transmit the display information to another room, for example.With a CID, there are no accessible wires which connect the display tothe electronics package, for example. Finally, the display itself isprotected. The test-taker 410 can wear a camera which has a lens thesize of a small pea but in order for that camera to see the display, itwill also be seen by the iris imager or the eye-to-display cameras.

Of course, if a cheating method is discovered, it will quickly becomepublic through the Internet, defeating the Test Glasses solution.Therefore, a continuous improvement process which rewards students whodiscover cheating methods should be implemented.

At the discretion of the institution, a time limit or no time limit canbe afforded the test-taker 410 for completing the test. Similarly, acourse can have only a single final exam or a series of quizzes inaddition to a final exam or feedback can be requested from thetest-taker 410 during each course session depending on the course andthe desires of the institution. Since all such tests will be gradedautomatically, the cost of having daily or more frequent quizzes versusa single final exam is insignificant. In one extreme case, all of therequired courses can be given without any exams and a finalcomprehensive exam can be used to validate a student for receiving adegree. Alternately, the student can be tested continuously during thecourse or degree process without any final examinations. These decisionsare left up to the institution. These options are facilitated due to theability of the student to observe instruction presented on the computerscreen and at arbitrary times be tested using the Test Glasses.

The student can enter data into the testing program through the keyboard426, a track pad (not shown), and/or the mouse 428, or any other type ofuser interface such as a touch screen of the laptop computer 420. Themouse 428 can be attached to the computer 420 with a fixed wire or bewirelessly connected to the computer 420.

Various biometric technologies for verifying the identity of thetest-taker for use with Test Glasses will now be discussed. Since theTest Glasses are mounted on the head in front of the eyes, the mostreadily available biometrics are images of the eyes or facial tissuessurrounding the eyes. A variety of different biometric tests can bedevised, but the most common are retinal scans and iris scans. Both ofthese are available using a camera mounted in conjunction with thedisplay. The retinal scan is used to examine the pattern of bloodvessels at the back of the eye. Although retinal patterns may be alteredin cases of diabetes, glaucoma or retinal degenerative disorders, theretina typically remains unchanged from birth until death. Due to itsunique and unchanging nature, the retina appears to be the most preciseand reliable biometric, aside from DNA. Advocates of retinal scanninghave concluded that it is so accurate that its error rate is estimatedto be only one in a million. The blood vessels within the retina absorblight more readily than the surrounding tissue and are easily identifiedwith appropriate lighting. A retinal scan is performed by casting anunperceived beam of low-energy infrared light into a person's eye asthey look through the scanner's eyepiece. This beam of light traces astandardized path on the retina. Because retinal blood vessels are moreabsorbent of this light than the rest of the eye, the amount ofreflection varies during the scan. The pattern of variations isconverted to computer code and stored in a database.

The iris scan is an automated method of biometric identification thatuses mathematical pattern-recognition techniques on video images of theirises of an individual's eyes, whose complex random patterns are uniqueand can be seen from some distance. Not to be confused with other, lessprevalent, ocular-based technologies, retina scanning and eye printing,iris recognition uses camera technology with subtle infraredillumination to acquire images of the detail-rich, intricate structuresof the iris externally visible at the front of the eye. Digitaltemplates encoded from these patterns by mathematical and statisticalalgorithms allow the identification of an individual. Many millions ofpersons in several countries around the world have been enrolled in irisrecognition systems, for convenience purposes such as passport-freeautomated border-crossings, and some national ID systems based on thistechnology are being deployed. A key advantage of iris recognition,besides its speed of matching and its extreme resistance to falsematches, is the stability of the iris as an internal, protected, yetexternally visible organ of the eye.

Both of these scans are extremely accurate and very difficult to fake.Since the apparatus for conducting these scans is protected by thechassis intrusion detector system, they are the preferred biometricidentification systems for use with this invention. Although it has beenproposed that secure testing systems utilize more than one biometricidentification, the accuracy of either of the retinal or iris scans isso high as to eliminate the need for a second biometric. The iris scanis somewhat easier to implement and therefore is the preferred systemfor use with this invention.

Consideration is necessary concerning where the test-taker's biometricsare stored. If they are transmitted to the test-providing institution,then there is the risk that if they are not encrypted that thetransmission can be captured, allowing a consultant to log on as thetest-taker in the future. If they are encrypted at the laptop, then eventhe encrypted biometrics can be captured and used by the consultant. Asolution is for the institution to transmit an encrypted random numberto the laptop which combines that number with a code representing thesuccess or failure of a biometrics measurement and transmits acombination of the decrypted random number and the code back to theinstitution. For example, assume that the random number was 45896 and 1represents a biometrics failure and 0 a success. The laptop upon failureof the biometrics test would return 45897 to the institution and theinstitution would then not proceed with the test. Thus, if the privatekey is secure on the laptop, then only the laptop needs to know thetest-taker's biometrics which will be stored only locally and can bestored in a coded manner which makes spoofing by another systemdifficult or impossible.

A schematic of the operation of the chassis intrusion detector of FIG.1A is provided in FIG. 7 for the labyrinth circuit case. Since thechassis intrusion detector is designed to encompass the entireelectronics and sensors assembly, it must be relatively thin so as notto interfere with the microphone and speaker and be transparent such asto not interfere with the display or cameras. One method is to form afilm comprising several layers. The first layer adjacent to theapparatus would be a thin plastic film. Onto that layer is deposited athin layer of a conductive material which can be indium tin oxide orgraphic scene. The former is relatively available whereas the grassscene is becoming more and more available. After the conductive layer isdeposited onto the first plastic layer, a second thin plastic layer isdeposited over the conductive layer and a second conductive layer isdeposited onto the second plastic layer. Finally, the assembly iscompleted with the depositing of a third plastic layer. Each of theselayers is typically between about 0.001 and about 0.010 inches thick andthe total assembly is transparent.

The chassis intrusion detector can contain its own microprocessorsecurity assembly 454 and battery 458. It also contains its own RAMmemory 456. The RAM memory 456 contains the private key which is keptalive by the battery 458. The battery 458 is chosen such that it canprovide sufficient power to maintain the RAM memory 456 active forseveral years and also provide power to the microprocessor to monitorthe conductive films. The conductive films are attached to themicroprocessor which checks for the capacitance between the two films.Any change in this capacitance detected by the microprocessor isindicative of an attempt to intrude into the interior of the electronicsand sensors assembly. If such intrusion is detected then power isremoved from the RAM memory 456 and the private key pair raced.

Since a carefully placed hole or multiple holes through the plastic filmassembly can cause only a minor change in the capacitance, a preferredalternative construction, as illustrated in FIG. 7, is to replace thetwo conductive layers and separating plastic film with a single layercomprising a labyrinth of wires which are very narrow and closely spacedsuch that any attempt to penetrate the film will cause one or more ofthese wires to be cut. The microprocessor therefore monitors the totalresistance, inductance or mutual inductance of this circuit and erasesthe private key if there is a significant change in these measurements.Since any attempt to break into the electronic and sensor assembly willnecessarily sever one of these wires, this design provides an easilydetectable method of determining an attempt to intrude into the systemelectronics and sensor assembly.

A schematic of the chassis intrusion detector system is shown in FIG. 7generally at 450. Power is supplied from the external computer at 460through the USB connector 24 of FIG. 1A. Wire 460 also providescommunication from the electronics and sensors assembly of which thesecurity assembly SA is a part. The fine wire maze is shown at 452, thesecurity assembly (SA) at 454, the long life battery at 458 and the RAMmemory at 456. The security assembly (SA) 454 can be a separatesubassembly which is further protected by being potted with a materialsuch that any attempt to obtain access to the wires connecting thebattery to the microprocessor therein or to the RAM memory 456 would bebroken during such an attempt. This is a secondary precaution sincepenetration to the SA 454 should not be possible without destroying theprivate key.

To summarize, any disruption of the mash or conductive film in either ofthe above described examples will destroy the private key making itimpossible to decode the test questions. After the assembly iscompleted, the computer can be powered on and the first step would be tomeasure the inductance, resistance, and capacitance, as appropriate, ofthe mesh or films. Thereafter, if any of these measurementssignificantly change, then the circuit in the SA 454 would remove powerfrom the RAM memory 456 thereby destroying the private key. Since theprivate key cannot be reloaded, the assembly would need to be returnedto the factory for remanufacture and the insertion of a new SA 454 orentire electronics and sensors assembly.

The Test Glasses can be used by students remotely located from theinstitution providing the test. Alternatively as illustrated in FIG. 8,the Test Glasses can be used by a room full of test-takers where eachdevice is attached to a central computer through, for example, a USBport. In this case, each student 502 is provided with a keyboard and/ora mouse or other input device, and a display 504. Each of the devices isconnected to a central computer 506. Otherwise, the operation of theTest Glasses is as described above.

FIG. 9 is a view similar to FIG. 8 where the answers are placed on apiece of paper which will be collected by the test proctor at theconclusion of the test. Again, since each student will be taking thesame test with the questions randomly reordered, there is no advantagein a student surreptitiously communicating an answer to another student.Thus, by virtue of the arrangements depicted in FIG. 8 and FIG. 9, theTest Glasses can be used either remotely or in in a classroomenvironment.

An exemplifying, non-limiting system process flowchart is illustratedgenerally at 600 in FIG. 10.

-   -   1. The student plugs the USB connector from the Test Glasses        into the intermediary computer at step 602, puts on the Test        Glasses which recognizes that the student's eye is in view of        the iris imaging camera.    -   2. The student logs on to the Internet and communicates with the        test providing institution at step 604. If this communication        attempt is successful, then the student will be prompted to        identify himself/herself which may include his student        identification code or number and indicates that he/she is ready        to take a test.    -   3. The student is prompted to enter the identification of the        course for which he or she desires to take the test at step 606.        Software at the institution then determines the appropriate test        to be provided to the student, for example, based on his or her        progress to date. The student's biometrics can now be verified        at step 608.    -   4. The test providing institution modifies the standard test to        be given to the test-takers by rearranging the questions in a        random order and associates that order with the student's ID.    -   5. Once the appropriate test has been determined, it is        downloaded to the intermediary computer and forwarded to the        Test Glasses for decryption and displayed at step 610. The        initial page of the test is then displayed on the display 12 of        the Test Glasses and the student indicates his or her readiness        to start the test at step 612.    -   6. The Test Glasses continue to perform iris scans throughout        the test to verify that the Test Glasses have not been removed        and that the proper student is taking the test. Initially, a        message can be sent to the test-providing institution via the        intermediary computer indicating that the device has        successfully verified the student's biometrics if desired by the        institution.    -   7. The Test Glasses performs an analysis from the forward (14)        and eye-to-display (30) imagers to verify that the test        requirements for the environment are met and a microphone (16)        functioning test is performed by the speaker (18) admitting a        sound to the microphone which is analyzed to ascertain that it        has been properly received at step 614.    -   8. A display appears on the intermediary computer listing the        question numbers and providing a space for the answers.    -   9. If appropriate, the test timer is started at step 616 and the        student proceeds to read the questions and answer them using the        keyboard and/or the mouse attached to the intermediary computer.    -   10. The forward looking camera constantly monitors the field of        view of the student to check for any violation of the test        rules.    -   11. The microphone also constantly monitors the sound in the        vicinity of the student to check for any verbal violation of the        test rules.    -   12. The iris imaging camera constantly verifies that the iris        exists at its expected location indicating that the student        continues to wear the Test Glasses.    -   13. If the iris is not found or there are any other violations        of the test rules discovered, then the display is extinguished.    -   14. Depending on the rules which were violated causing the        display to be extinguished, remedial action is undertaken as        dictated by the test providing institution.    -   15. Using the keyboard or mouse associated with the intermediary        computer, the student indicates that he has completed taking the        test at step 618.    -   16. Upon completion, the test answers are forwarded to the        institution by the intermediary computer.

Special software is required for the external computer. This softwaremay vary depending on the operating system of that computer butgenerally will be provided by the test-providing institution. Thissoftware will manage the interface between the Test Glasses and thetest-providing institution. The software also will not permit anyinformation to be displayed on the screen while the test is underwayother than information related to the test. The forward monitoringcamera 14 will confirm that there is no unexpected information displayedon the computer screen and if so a fault will be indicated and the testterminated.

Some important features of this invention differentiate it significantlyfrom prior art attempts to develop secure testing systems. Theseinclude:

-   -   1. The use of a head-mounted display for presenting randomized        questions to the student in a manner that such questions cannot        be obtained or observed by another person. Such a display can be        in the form of a small light emitting display held near to the        eye of the student or a retinal projector which projects the        contents of the display on to the student's retina.    -   2. The same test is given to multiple students wherein the order        of the tests questions is randomized to prevent the passing of        answers from one student to another. Each student will take the        identical test but the questions are ordered differently.    -   3. The test taking process is fully automatic and does not        require any human intervention. In the event that the student        violates the rules of the institution, the particular violation        will be noted and provided to the student. The institution will        only get involved if the student protests the results.    -   4. No data is transmitted in an encrypted form from the Test        Glasses to the test providing institution. The test-providing        institution knows the test that was provided to the student        based on his/her ID and therefore knows how to match the test        answers with the questions.    -   5. No video or audio data is forwarded to the test taking        institution. If the test was successfully complete it is assumed        that no cheating occurred. If the test is interrupted, then        diagnostic information can be retained and upon request of the        institution forwarded thereto for diagnostic purposes. In        general, neither video nor audio information is stored during        the test taking process unless the test is interrupted.    -   6. No behavioral measurements are made, recorded, or sent to the        institution and thus it is not necessary to try to interpret        cheating activity based on biometric or other measurements.    -   7. The test questions are only available to the display or        retinal projector which are part of the Test Glasses and        protected using strong encryption and by the chassis intrusion        detecting system.    -   8. Since it is virtually impossible for a consultant to observe        a copy of the test, attempts to determine that a consultant is        communicating with the student other than oral communications        are unnecessary. Such communications from the consultant are        impossible to reliably detect.    -   9. The decryption private key is created as part of a key pair        by the test providing institution and after loading into the        test glasses, the private key is destroyed. Since the only copy        that exists is on the test glasses and protected by the chassis        intrusion detector, no other device can decrypt the test which        has been created by the test-providing institution uniquely for        the particular Test Glasses.    -   10. The use of sophisticated neural network based pattern        recognition algorithms allow for continuous improvement of this        system if and when new cheating methods are discovered. This        allows for upgrading the software of the system as new        improvements are implemented.

Disclosed herein are a series of measures that are designed to preventthe transfer of test related information to anyone other than the testtaking student by any means either visually, electronically, orwirelessly. The measures disclosed herein are not exhaustive and theintent of this invention is to cover preferred implementations of suchtechniques. Similarly, disclosed herein are a series of measures toprevent information from being transmitted to the test taking student onthe assumption that the information about the test has leaked to aconsultant. Since the consultant now must transmit to the studentinformation which will affect how the student answers the question, thisinvention has also not exhaustively disclosed all possibilities ofinformation transferal from the consultant but only representativecases. It is not the intent of the inventor to cover all such transferalmeans including, for example, haptic methods which have not beendiscussed above. These include, for example, a wire attached to thestudent and physically held by the consultant who may in fact be locatedin another room wherein the wire travels through a hole in a wall. Inthis case, for example, if the consultant knows the test question andhas determined that the proper answer is three then the consultant couldpull three times on the wire thereby transmitting this information tothe student. All sorts of similar haptic techniques exist includingelectrically actuated vibrators, spark creators etc. To cover all suchpossibilities of either the leaks of information out of the test takingdevice or the communication of information to the student would requirevolumes. Thus, it is the intent of the inventor to cover all suchpossibilities while disclosing those that are most readily implemented.

Finally, all patents, patent application publications and non-patentmaterial identified above are incorporated by reference herein. Thefeatures disclosed in this material may be used in the invention to theextent possible.

1. A headpiece, comprising: a frame having a support portion adapted tobe supported on a person's head; a first imaging device arranged on saidframe to obtain images of an environment around and in front of theperson when said support portion is supported on the person's head; abiometric identification system arranged on said frame and configured toobtain biometric data about the person when said support portion issupported on the person's head; a display arranged on said frame andviewable by the person when said support portion is supported on theperson's head; a sound detection interference monitoring system arrangedon said frame; and a processor arranged on said frame and coupled tosaid first imaging device, said biometric identification system, saiddisplay, said sound interference detection system and configured tocontrol content of said display based on input received via said firstimaging device and said biometric identification system, said processorbeing further configured to monitor detection of audio communications bysaid sound detection interference monitoring system and images obtainedby said first imaging device when said support portion is supported bythe person's head and a test is displayed on said display to determinewhether a person other than the person on which said support portion issupported is present in images obtained by said first imaging device ororally providing information to the person on which said support portionis supported.
 2. The headpiece of claim 1, further comprising a housingextending below said frame, said first imaging device, said biometricidentification system, said display, said sound detector and said soundgenerator being arranged on said housing.
 3. The headpiece of claim 2,further comprising an additional imaging device arranged on said housingto image said frame.
 4. The headpiece of claim 1, wherein said biometricidentification system comprises a second imaging device arranged on saidframe to obtain images of an iris of the person when said supportportion is supported on the person's head.
 5. The headpiece of claim 4,further comprising an illuminator that illuminates the iris of theperson in conjunction with imaging of the iris by said second imagingdevice.
 6. The headpiece of claim 1, further comprising a connector forconnecting said processor to an external electronic device.
 7. Theheadpiece of claim 1, further comprising headphones adapted to overlieears of the person when said support portion is supported by theperson's head.
 8. The headpiece of claim 1, wherein said sound detectioninterference monitoring system comprises a sound generator that transmitsound waves and a sound detector that receives sound waves, saidprocessor being configured to analyze transmitted sound waves relativeto received sound waves to assess detection of sound by said sounddetector.
 9. The headpiece of claim 1, further comprising a chassisintrusion detection system integrated into said frame to prevent accessto said processor.
 10. The headpiece of claim 9, wherein said chassisintrusion detection system comprises two closely spaced conductive filmsoverlying one another that enclose said frame, and a security assemblyexterior of said enclosed frame and coupled to said films, said securityassembly being configured to periodically measure capacitance betweensaid films and monitor the measured capacitance to determine changes incapacitance that indicate an attempt to access an interior of saidenclosed frame.
 11. The headpiece of claim 10, wherein said securityassembly includes a processor, a power source for providing power tosaid processor and a RAM assembly containing a required security codefor use of the device for test-taking purposes, said security assemblybeing configured such that any attempt to disassemble said securityassembly will break one or more wires connecting said power source tosaid processor and such that a change in capacitance relative to athreshold will cause the security code to be erased from said RAMassembly.
 12. The headpiece of claim 10, wherein said films aretransparent at a portion that overlies said display to enable viewing ofcontent of said display of said enclosed frame.
 13. The headpiece ofclaim 10, wherein said films are transparent at a portion that overliessaid first imaging device to enable imaging by said first imaging deviceof said enclosed frame.